fix: SEC16

src/api/client/session.rs

@@ -87,6 +87,10 @@ pub(crate) async fn handle_login(
 		return Err!(Request(InvalidParam("User ID does not belong to this homeserver")));
 	}
 
+	if services.users.is_deactivated(&user_id).await? {
+		return Err!(Request(UserDeactivated("This account has been deactivated.")));
+	}
+
 	if services.users.is_locked(&user_id).await? {
 		return Err!(Request(UserLocked("This account has been locked.")));
 	}

src/api/router/auth.rs

@@ -162,6 +162,9 @@ impl CheckAuth for AccessToken {
 		query: AuthQueryParams,
 		route: TypeId,
 	) -> Result<Self::Identity> {
+		if output.is_empty() {
+			return Err!(Request(Unauthorized("Missing access token.")));
+		}
 		if let Ok((sender_user, sender_device)) = services.users.find_from_token(&output).await {
 			// Locked users can only use /logout and /logout/all
 			if services
@@ -259,6 +262,9 @@ impl CheckAuth for AppserviceToken {
 		_query: AuthQueryParams,
 		_route: TypeId,
 	) -> Result<Self::Identity> {
+		if output.is_empty() {
+			return Err!(Request(Unauthorized("Missing access token.")));
+		}
 		let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
 			return Err!(Request(Unauthorized("Invalid appservice token.")));
 		};